CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-2056 – DedeCMS module_main.php GetSystemFile code injection
https://notcve.org/view.php?id=CVE-2023-2056
14 Apr 2023 — A vulnerability was found in DedeCMS up to 5.7.87 and classified as critical. This issue affects the function GetSystemFile of the file module_main.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://gitee.com/ashe-king/cve/blob/master/dedecms%20rce2.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27709
https://notcve.org/view.php?id=CVE-2023-27709
16 Mar 2023 — SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dedestory_catalog.php endpoint. • https://srpopty.github.io/2023/02/27/DedeCMS-V5.7.160-Backend-SQLi-story • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27707
https://notcve.org/view.php?id=CVE-2023-27707
16 Mar 2023 — SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint. • https://srpopty.github.io/2023/02/27/DedeCMS-V5.7.160-Backend-SQLi-group • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46442
https://notcve.org/view.php?id=CVE-2022-46442
27 Dec 2022 — dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. dedecms <=V5.7.102 es vulnerable a la inyección SQL. En sys_ sql_ n query.php no hay restricciones en la consulta SQL. • https://gist.github.com/yinfei6/f2b311374de4b4cec1dc22433d38c92a • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18114
https://notcve.org/view.php?id=CVE-2020-18114
27 Aug 2021 — An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format. Una vulnerabilidad de carga de archivos arbitrarios en el componente /uploads/dede de DedeCMS versión V5.7SP2, permite a atacantes carfar un webshell en manerato HTM. • https://blog.csdn.net/qq_36093477/article/details/86681178 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18917
https://notcve.org/view.php?id=CVE-2020-18917
24 Aug 2021 — The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because the contents of typename.inc are under an attacker's control. El componente plus/search.php de DedeCMS versión 5.7 SP2, permite a atacantes remotos ejecutar código PHP arbitrario por medio del parámetro typename porque el contenido del archivo typename.inc está bajo el control de un atacante. • http://tusk1.cn/2019/05/12/DeDecms-v5-7-sp2-CRSF-%E6%96%87%E4%BB%B6%E6%93%8D%E4%BD%9C-%E5%89%8D%E5%8F%B0getshell • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2020-22198
https://notcve.org/view.php?id=CVE-2020-22198
16 Jun 2021 — SQL Injection vulnerability in DedeCMS 5.7 via mdescription parameter to member/ajax_membergroup.php. Una vulnerabilidad de inyección SQL en DedeCMS versión 5.7 por medio de un parámetro mdescription en el archivo member/ajax_membergroup.php • http://www.hackdig.com/?02/hack-8391.htm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-16632
https://notcve.org/view.php?id=CVE-2020-16632
14 May 2021 — A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter. Una vulnerabilidad de tipo XSS en el archivo /uploads/dede/action_search.php en DedeCMS versión V5.7 SP2, permite a un usuario autenticado ejecutar código arbitrario remoto por medio del parámetro keyword • https://github.com/ky-j/dedecms/issues/12 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32073
https://notcve.org/view.php?id=CVE-2021-32073
14 May 2021 — DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution. DedeCMS versión V5.7 SP2, contiene una vulnerabilidad de tipo CSRF que permite a un atacante remoto enviar una petición maliciosa al administrador web, permitiendo una ejecución de código remota • https://github.com/ky-j/dedecms/issues/12 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 20%CPEs: 3EXPL: 2CVE-2015-4553 – DeDeCMS < 5.7-sp1 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2015-4553
06 Jan 2020 — A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. Existe un problema de carga de archivos en DeDeCMS versiones anteriores a 5.7-sp1, lo que permite getshell a usuarios maliciosos. • https://www.exploit-db.com/exploits/37423 • CWE-434: Unrestricted Upload of File with Dangerous Type •